tsecurity.de - News Radar & Live Feeds

CVE-2026-90725 | Dell PowerProtect Data Domain up to 8.8 stack-based overflow (EUVD-2026-110862)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability marked as problematic has been reported in Dell PowerProtect Data Domain up to 8.8. This vulnerability affects unknown code. Performing a manipulation results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-90725. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-117503 | a2aproject a2a-go up to 2.4.0 REST SSE handler a2asrv/rest.go resource consumption (ID 396 / EUVD-2026-110861)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability classified as problematic has been found in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. The identification of this vulnerability is CVE-2026-117503. It is possible to initiate the attack remotely. There is... Weiterlesen

CVE-2026-68866 | Dell PowerProtect Data Domain Certificate path traversal (EUVD-2026-110860)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability identified as problematic has been detected in Dell PowerProtect Data Domain. Affected by this issue is some unknown functionality of the component Certificate. This manipulation causes path traversal. The identification of this vulnerability is CVE-2026-68866. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-83382 | Oracle Report Manager up to 12.2.15 Internal Operations information disclosure (EUVD-2026-106300)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability categorized as problematic has been discovered in Oracle Report Manager up to 12.2.15. This affects an unknown part of the component Internal Operations. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-83382. The attack may be launched remotely. There is no exploit... Weiterlesen

CVE-2026-95619 | Red Hat libstdc++ integer overflow (Nessus ID 372263)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability identified as critical has been detected in Red Hat libstdc++. This impacts an unknown function. Performing a manipulation results in integer overflow. This vulnerability is reported as CVE-2026-95619. The attack is possible to be carried out remotely. No exploit exists. Weiterlesen

CVE-2023-49288 | Squid Proxy up to 6.0.0 Collapsed Forwarding use after free (GHSA-rj5h-46j6-q2g5 / Nessus ID 372261)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as problematic, was found in Squid Proxy up to 6.0.0. Affected is an unknown function of the component Collapsed Forwarding Handler. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2023-49288. It is possible to launch the attack remotely. No exploit is available.... Weiterlesen

CVE-2026-86848 | Red Hat DPDK vhost-crypto out-of-bounds (Nessus ID 372250)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in Red Hat DPDK. It has been declared as problematic. The affected element is an unknown function of the component vhost-crypto. Such manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-86848. Local access is required to approach this attack. No exploit exists. Weiterlesen

CVE-2026-86565 | Red Hat Enterprise Linux vhost out-of-bounds write (Nessus ID 372250)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability identified as very critical has been detected in Red Hat Enterprise Linux, Fast Datapath for RHEL, OpenShift Container Platform and OpenStack Platform. Affected by this issue is some unknown functionality of the component vhost. Performing a manipulation results in out-of-bounds write. This vulnerability is known as CVE-2026-86565.... Weiterlesen

CVE-2026-100236 | Red Hat Enterprise Linux GSO Library integer overflow (Nessus ID 372250)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as very critical, was found in Red Hat Enterprise Linux, Fast Datapath, OpenShift Container Platform and OpenStack Platform. The impacted element is an unknown function of the component GSO Library. Such manipulation leads to integer overflow. This vulnerability is documented as CVE-2026-100236. The attack can... Weiterlesen

CVE-2026-103263 | TornadoWeb Tornado up to 6.5.8 StaticFileHandler path traversal (Nessus ID 372243)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in TornadoWeb Tornado up to 6.5.8. It has been declared as problematic. Affected by this issue is the function StaticFileHandler. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2026-103263. It is possible to launch the attack remotely. No exploit is available. It is... Weiterlesen

CVE-2026-111381 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v2 height heap-based overflow (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. Affected by this issue is the function persistent_cache_read_entry_v2 of the component Persistent Cache. The manipulation of the argument height leads to heap-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-111381. Local... Weiterlesen

CVE-2026-111382 | FreeRDP up to 3.31.x RDPGFX general_LumaToYUV444 out-of-bounds write (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in FreeRDP up to 3.31.x. It has been declared as critical. This vulnerability affects the function general_LumaToYUV444 of the component RDPGFX. Such manipulation leads to out-of-bounds write. This vulnerability is listed as CVE-2026-111382. The attack may be performed from remote. There is no available exploit. It is... Weiterlesen

CVE-2026-113713 | pypa virtualenv up to 21.14.9 App-Data Seeder state issue (EUVD-2026-105259)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as problematic, has been found in pypa virtualenv up to 21.14.9. This affects an unknown function of the component App-Data Seeder. The manipulation leads to state issue. This vulnerability is traded as CVE-2026-113713. An attack has to be approached locally. There is no exploit available. It is advisable to... Weiterlesen

CVE-2026-90726 | Dell PowerProtect Data Domain up to 8.6.1.20 path traversal (EUVD-2026-110859)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability labeled as problematic has been found in Dell PowerProtect Data Domain up to 7.7.1.0/8.8/7.13.1.80/8.3.1.40/8.6.1.20. This affects an unknown part. Such manipulation leads to path traversal. This vulnerability is referenced as CVE-2026-90726. The attack can only be performed from a local environment. No exploit is available. Weiterlesen

CVE-2026-113718 | pypa virtualenv up to 21.14.8 Xonsh Activation activate.xsh quote XONSH_ENCODING encoding error (EUVD-2026-105299)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability labeled as problematic has been found in pypa virtualenv up to 21.14.8. The affected element is the function quote of the file activate.xsh of the component Xonsh Activation. Such manipulation of the argument XONSH_ENCODING leads to encoding error. This vulnerability is listed as CVE-2026-113718. The attack must be carried out... Weiterlesen

CVE-2026-90727 | Dell PowerProtect Data Domain up to 8.8 path traversal (EUVD-2026-110858)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability described as problematic has been identified in Dell PowerProtect Data Domain up to 8.8. This issue affects some unknown processing. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-90727. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-83377 | Oracle HRMS up to 12.2.15 Mobile Applications privileges management (EUVD-2026-106295)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability marked as problematic has been reported in Oracle HRMS up to 12.2.15. Impacted is an unknown function of the component Mobile Applications. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-83377. The attack is possible to be carried out remotely. No exploit exists. It is suggested to... Weiterlesen

CVE-2026-83366 | Oracle Shipping Execution up to 12.2.15 Workflow Events access control (EUVD-2026-106286)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as critical, has been found in Oracle Shipping Execution up to 12.2.15. The affected element is an unknown function of the component Workflow Events. Performing a manipulation results in improper access controls. This vulnerability is reported as CVE-2026-83366. The attack is possible to be carried out... Weiterlesen

CVE-2026-111378 | FreeRDP up to 3.31.x NLA Parsing parse_nla_mode_pdu resource consumption (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in FreeRDP up to 3.31.x. It has been classified as problematic. This affects the function parse_nla_mode_pdu of the component NLA Parsing. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-111378. The attack is possible to be carried out remotely. No exploit exists. Upgrading the... Weiterlesen

CVE-2026-111377 | FreeRDP up to 3.31.x Static Virtual Channel WTSProcessChannelData resource consumption (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. This impacts the function WTSProcessChannelData of the component Static Virtual Channel. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2026-111377. The attack may be initiated remotely. There is no available... Weiterlesen

CVE-2026-110838 | FreeRDP up to 3.31.x Shadow Server injection (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in FreeRDP up to 3.31.x. It has been rated as problematic. This issue affects some unknown processing of the component Shadow Server. The manipulation leads to injection. This vulnerability is listed as CVE-2026-110838. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component... Weiterlesen

CVE-2026-109242 | FreeRDP up to 2.x/3.31.x Tile Rendering out-of-bounds (Nessus ID 372241)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability identified as critical has been detected in FreeRDP up to 2.x/3.31.x. Affected by this vulnerability is an unknown functionality of the component Tile Rendering. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-109242. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-28167 | Super Forms Plugin up to 6.3.315 on WordPress information disclosure (EUVD-2026-64796 / CNNVD-2026-96785795)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability identified as problematic has been detected in Super Forms Plugin up to 6.3.315 on WordPress. Impacted is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-28167. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2026-117506 | a2aproject a2a-java up to 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption (ID 1044 / EUVD-2026-110929)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability, which was classified as problematic, was found in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file... Weiterlesen

CVE-2026-114609 | py-pdf fpdf2 up to 2.8.7 Shared Image Loader FPDF.image/FPDF.write_html server-side request forgery (EUVD-2026-108261)

Tue, 27 Oct 2026 17:24:24 +0100

A vulnerability was found in py-pdf fpdf2 up to 2.8.7. It has been rated as problematic. This issue affects the function FPDF.image/FPDF.write_html of the component Shared Image Loader. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-114609. The attack can be initiated remotely. There is not any... Weiterlesen

CVE-2026-117999 | Mozilla Firefox up to 153.5/158 IPC race condition (EUVD-2026-110898)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Mozilla Firefox up to 153.5/158. It has been classified as critical. This affects an unknown function of the component IPC. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-117999. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the... Weiterlesen

CVE-2026-117604 | Getgrav Grav up to 1.7.53.5 Debugger isDebuggerRequestAuthorized authorization (EUVD-2026-110928)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability categorized as problematic has been discovered in Getgrav Grav. This affects the function Debugger::isDebuggerRequestAuthorized of the component Debugger. Such manipulation leads to authorization bypass. This vulnerability is listed as CVE-2026-117604. The attack may be performed from remote. There is no available exploit. It is... Weiterlesen

CVE-2026-117976 | Mozilla Firefox up to 153.5/158 Navigation isolation (EUVD-2026-111007)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.5/158. This affects an unknown function of the component Navigation. Performing a manipulation results in improper isolation or compartmentalization. This vulnerability is reported as CVE-2026-117976. The attack is possible to be carried out remotely. No exploit... Weiterlesen

CVE-2026-117505 | a2aproject a2a-java up to 1.2.0.Final ChildQueue queue.offer resource consumption (ID 1040 / EUVD-2026-110927)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability, which was classified as problematic, has been found in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-117505. The attack can be initiated remotely. There is... Weiterlesen

CVE-2026-118008 | Mozilla Firefox up to 158 Navigation privileges management (EUVD-2026-110906)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability identified as critical has been detected in Mozilla Firefox up to 158. Affected by this issue is some unknown functionality of the component Navigation Component. The manipulation leads to improper privilege management. This vulnerability is listed as CVE-2026-118008. The attack may be initiated remotely. There is no available... Weiterlesen

CVE-2026-76957 | Libexpat up to 2.8.3 use after free (Nessus ID 372240 / WID-SEC-2026-2930)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability, which was classified as critical, has been found in Libexpat up to 2.8.3. The affected element is an unknown function. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-76957. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected... Weiterlesen

CVE-2026-111379 | FreeRDP up to 3.31.x Persistent Cache persistent_cache_read_entry_v3 width/height heap-based overflow (Nessus ID 372227)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability, which was classified as problematic, was found in FreeRDP up to 3.31.x. This affects the function persistent_cache_read_entry_v3 of the component Persistent Cache. The manipulation of the argument width/height results in heap-based buffer overflow. This vulnerability was named CVE-2026-111379. The attack needs to be approached... Weiterlesen

CVE-2026-110839 | FreeRDP up to 3.31.x JPEG Conversion winpr_convert_from_jpeg heap-based overflow (Nessus ID 372227)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.31.x. Impacted is the function winpr_convert_from_jpeg of the component JPEG Conversion. The manipulation results in heap-based buffer overflow. This vulnerability is cataloged as CVE-2026-110839. The attack may be launched remotely. There is no exploit available. It... Weiterlesen

CVE-2026-109823 | Tidewave AI up to 0.9.1 Host Header Validation cross-domain policy (EUVD-2026-111085)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability has been found in Tidewave AI Tidewave up to 0.9.1 and classified as problematic. This issue affects some unknown processing of the component Host Header Validation. The manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is traded as CVE-2026-109823. It is possible to initiate the attack... Weiterlesen

CVE-2026-117510 | Dexmal Dexbotic up to 0.2.0 gr00tsonic Checkpoint Loader gr00tsonic_arch.py load_pretrained_gr00t weight_map path traversal (Issue 103 / EUVD-2026-111084)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Dexmal Dexbotic up to 0.2.0. It has been classified as critical. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. This... Weiterlesen

CVE-2026-114618 | Authlib up to 1.8.x JWT Bearer Grant JWTBearerGrant.get_audiences improper authorization (EUVD-2026-108520)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Authlib up to 1.8.x. It has been declared as critical. The affected element is the function JWTBearerGrant.get_audiences of the component JWT Bearer Grant. The manipulation results in improper authorization. This vulnerability was named CVE-2026-114618. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-114617 | Authlib up to 1.8.x OpenID Connect sync_openid.py OpenIDMixin.parse_id_token authentication replay (EUVD-2026-108519)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Authlib up to 1.8.x. It has been classified as critical. Impacted is the function OpenIDMixin.parse_id_token of the file authlib/integrations/base_client/sync_openid.py of the component OpenID Connect. The manipulation leads to authentication bypass by capture-replay. This vulnerability is uniquely identified as... Weiterlesen

CVE-2026-114619 | Authlib up to 1.8.x Implicit Grant implicit.py improper authorization (EUVD-2026-108521)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Authlib up to 1.8.x and classified as problematic. This issue affects the function OpenIDImplicitGrant.validate_authorization_request of the file authlib/oidc/core/grants/implicit.py of the component Implicit Grant. Executing a manipulation can lead to improper authorization. This vulnerability is handled as... Weiterlesen

CVE-2026-114615 | Authlib up to 1.8.x OctKey oct_key.py OctKey.import_key improper authentication (EUVD-2026-108514)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in Authlib up to 1.8.x. It has been rated as critical. This issue affects the function OctKey.import_key of the file authlib/jose/rfc7518/oct_key.py of the component OctKey. The manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-114615. Remote exploitation of the attack is... Weiterlesen

CVE-2026-108360 | PHPOffice PhpSpreadsheet up to 5.9.x Image URL Validation setPath server-side request forgery (EUVD-2026-108264)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. It has been classified as problematic. This affects the function Worksheet\Drawing::setPath of the component Image URL Validation. The manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-108360. It is possible to... Weiterlesen

CVE-2026-108359 | PHPOffice PhpSpreadsheet up to 5.9.x Ods Reader Ods.php Ods::processTableRow resource consumption (EUVD-2026-108267)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability described as problematic has been identified in PHPOffice PhpSpreadsheet up to 1.30.6/2.1.18/2.4.7/3.10.7/5.9.x. This impacts the function Ods::processTableRow of the file src/PhpSpreadsheet/Reader/Ods.php of the component Ods Reader. The manipulation results in resource consumption. This vulnerability is identified as... Weiterlesen

CVE-2025-60424 | Nagios Fusion 2024R1.2/2024R2 OTP Verification excessive authentication

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability described as problematic has been identified in Nagios Fusion 2024R1.2/2024R2. This vulnerability affects unknown code of the component OTP Verification. Such manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is documented as CVE-2025-60424. The attack can be executed remotely.... Weiterlesen

CVE-2025-62396 | Moodle Router r.php exposure of information through directory listing (EUVD-2025-35671 / Nessus ID 276840)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability classified as problematic was found in Moodle. This impacts an unknown function of the file r.php of the component Router. Such manipulation leads to exposure of information through directory listing. This vulnerability is uniquely identified as CVE-2025-62396. The attack can be launched remotely. No exploit exists. Upgrading the... Weiterlesen

CVE-2025-50950 | Audiofile 0.3.7 ModuleState::setup null pointer dereference (Nessus ID 271717 / WID-SEC-2025-2882)

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability has been found in Audiofile 0.3.7 and classified as problematic. Impacted is the function ModuleState::setup. The manipulation leads to null pointer dereference. This vulnerability is referenced as CVE-2025-50950. The attack needs to be initiated within the local network. No exploit is available. Weiterlesen

CVE-2025-61035 | seffaflik up to 0.0.9 permission

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability marked as critical has been reported in seffaflik up to 0.0.9. Affected by this vulnerability is an unknown functionality. The manipulation leads to permission issues. This vulnerability is uniquely identified as CVE-2025-61035. Local access is required to approach this attack. No exploit exists. Weiterlesen

CVE-2025-60335 | TOTOLINK N600R 4.3.0cu.7866_B20220506 null pointer dereference

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in TOTOLINK N600R 4.3.0cu.7866_B20220506. It has been rated as critical. Affected is an unknown function. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2025-60335. The attacker must have access to the local network to execute the attack. No exploit exists. Weiterlesen

CVE-2025-52079 | D-Link DIR-820L 1.06B02 POST /get_set.ccp unverified password change

Tue, 27 Oct 2026 17:24:23 +0100

A vulnerability was found in D-Link DIR-820L 1.06B02. It has been rated as critical. This impacts an unknown function of the file /get_set.ccp of the component POST Handler. Performing a manipulation results in unverified password change. This vulnerability is reported as CVE-2025-52079. The attacker must have access to the local network to... Weiterlesen

CVE-2026-6653 reaches further than the libxml2 package name

Tue, 27 Oct 2026 17:23:17 +0100

CVE-2026-6653 reaches further than the libxml2 package name The advisory for CVE-2026-6653 names one upstream project, but the affected list is a map of downstream products. Anyone responsible for patching should read that list before assuming the update belongs to one team. One defect, many carriers Upstream, GNOME libxml2 2.9.11 through versions... Weiterlesen

CVE-2026-113000 | Google Chrome up to 155.0.8059.84 Paint memory corruption (WID-SEC-2026-4067)

Tue, 27 Oct 2026 15:36:50 +0100

A vulnerability labeled as critical has been found in Google Chrome. This affects an unknown part of the component Paint. Such manipulation leads to memory corruption. This vulnerability is uniquely identified as CVE-2026-113000. The attack can be launched remotely. No exploit exists. The affected component should be upgraded. Weiterlesen

CVE-2026-112999 | Google Chrome up to 155.0.8059.84 use after free (WID-SEC-2026-4067)

Tue, 27 Oct 2026 15:36:50 +0100

A vulnerability identified as critical has been detected in Google Chrome. Affected by this issue is some unknown functionality. This manipulation causes use after free. This vulnerability is handled as CVE-2026-112999. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component. Weiterlesen

CVE-2026-113001 | Google Chrome up to 155.0.8059.84 Workers use after free (WID-SEC-2026-4067)

Tue, 27 Oct 2026 15:36:49 +0100

A vulnerability marked as critical has been reported in Google Chrome. This vulnerability affects unknown code of the component Workers. Performing a manipulation results in use after free. This vulnerability was named CVE-2026-113001. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected... Weiterlesen

Keycloak Docker-Labor: CVE-2026-18963 prüfen [2026] - shattered.io

Tue, 27 Oct 2026 15:22:42 +0100

GamingCybersicherheitKI & Machine LearningHardwareKryptographiePrivatsphäreSoftwareKryptowährungCasinoEsports · Startseite · Cybersicherheit. Keycloak ... Weiterlesen

CVE-2026-95512 | FreeType Loader denial of service (Nessus ID 372200)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability, which was classified as problematic, has been found in FreeType. This impacts an unknown function of the component Loader. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-95512. Remote exploitation of the attack is possible. No exploit is available. Weiterlesen

CVE-2026-56154 | Apache HTTP Server up to 2.4.68 mod_rewrite use after free (Nessus ID 372189 / WID-SEC-2026-3703)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability has been found in Apache HTTP Server up to 2.4.68 and classified as very critical. This vulnerability affects unknown code of the component mod_rewrite. This manipulation causes use after free. This vulnerability appears as CVE-2026-56154. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-48005 | Apache HTTP Server up to 2.4.68 mod_auth_digest missing authentication (Nessus ID 372189 / WID-SEC-2026-3703)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability identified as critical has been detected in Apache HTTP Server up to 2.4.68. The affected element is an unknown function of the component mod_auth_digest. The manipulation leads to missing authentication. This vulnerability is referenced as CVE-2026-48005. Remote exploitation of the attack is possible. No exploit is available. You... Weiterlesen

CVE-2026-56153 | Apache HTTP Server up to 2.4.68 mod_charset_lite out-of-bounds write (Nessus ID 372189 / WID-SEC-2026-3703)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability, which was classified as critical, was found in Apache HTTP Server up to 2.4.68. This affects an unknown part of the component mod_charset_lite. The manipulation results in out-of-bounds write. This vulnerability is reported as CVE-2026-56153. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-94453 | Libreswan Project up to 5.3.2/5.4/5.4.0 IKE State st_iface_endpoint use after free (Nessus ID 372188)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in Libreswan Project Libreswan up to 5.3.2/5.4/5.4.0. It has been rated as critical. Affected is an unknown function of the component IKE State. The manipulation of the argument st_iface_endpoint leads to use after free. This vulnerability is traded as CVE-2026-94453. It is possible to initiate the attack remotely. There... Weiterlesen

CVE-2022-48022 | Zammad 5.3.0 Ticket /api/v1/mentions permission (EUVD-2022-50736)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability labeled as critical has been found in Zammad 5.3.0. This affects an unknown part of the file /api/v1/mentions of the component Ticket Handler. Executing a manipulation can lead to permission issues. This vulnerability is registered as CVE-2022-48022. It is possible to launch the attack remotely. No exploit is available. Weiterlesen

CVE-2022-48023 | Zammad 5.3.0 API permission (EUVD-2022-50737)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in Zammad 5.3.0. It has been rated as critical. Affected is an unknown function of the component API. This manipulation causes permission issues. This vulnerability is tracked as CVE-2022-48023. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is advised. Weiterlesen

CVE-2022-48063 | GNU Binutils up to 2.39 ELF File dwarf2.c load_separate_debug_files memory allocation (EUVD-2022-50777 / Nessus ID 212944)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability described as problematic has been identified in GNU Binutils up to 2.39. The impacted element is the function load_separate_debug_files of the file dwarf2.c of the component ELF File Handler. Such manipulation leads to uncontrolled memory allocation. This vulnerability is uniquely identified as CVE-2022-48063. The attack can only... Weiterlesen

CVE-2026-97023 | Red Hat Enterprise Linux path traversal (WID-SEC-2026-4147)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability, which was classified as problematic, was found in Red Hat Enterprise Linux. The impacted element is an unknown function. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2026-97023. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-97024 | Red Hat Enterprise Linux Flatpak path traversal (WID-SEC-2026-4147)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability marked as problematic has been reported in Red Hat Enterprise Linux. This impacts an unknown function of the component Flatpak. The manipulation leads to path traversal. This vulnerability is listed as CVE-2026-97024. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-85505 | FreeIPMI up to 1.6.18 ipmi-oem ipmi-oem-fujitsu.c ipmi_oem_fujitsu_get_sel_entry_long_text stack-based overflow (Nessus ID 349117 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in FreeIPMI up to 1.6.18. It has been declared as critical. This affects the function ipmi_oem_fujitsu_get_sel_entry_long_text of the file ipmi-oem/ipmi-oem-fujitsu.c of the component ipmi-oem. The manipulation results in stack-based buffer overflow. This vulnerability is known as CVE-2026-85505. It is possible to launch... Weiterlesen

CVE-2026-85504 | FreeIPMI up to 1.6.18 Fujitsu Sel String ipmi-sel-string-fujitsu-irmc-common.c _ipmi_sel_oem_fujitsu_get_sel_entry_long_text buffer overflow (Nessus ID 349117 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in FreeIPMI up to 1.6.18 and classified as very critical. The affected element is the function _ipmi_sel_oem_fujitsu_get_sel_entry_long_text of the file libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c of the component Fujitsu Sel String Handler. Executing a manipulation can lead to buffer overflow. This... Weiterlesen

CVE-2026-85507 | FreeIPMI up to 1.6.18 ipmi-oem ipmi-oem/ipmi-oem-dell.c _output_dell_system_info_cmc_info stack-based overflow (Nessus ID 349117 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability identified as very critical has been detected in FreeIPMI up to 1.6.18. Affected by this vulnerability is the function _output_dell_system_info_cmc_info of the file ipmi-oem/ipmi-oem-dell.c of the component ipmi-oem. Performing a manipulation results in stack-based buffer overflow. This vulnerability was named CVE-2026-85507. The... Weiterlesen

CVE-2026-85506 | FreeIPMI up to 1.6.18 idrac-info ipmi-oem/ipmi-oem-dell.c _get_dell_system_info_idrac_info buffer overflow (Nessus ID 349117 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability categorized as very critical has been discovered in FreeIPMI up to 1.6.18. Affected is the function _get_dell_system_info_idrac_info of the file ipmi-oem/ipmi-oem-dell.c of the component idrac-info. Such manipulation leads to buffer overflow. This vulnerability is uniquely identified as CVE-2026-85506. The attack can be launched... Weiterlesen

CVE-2026-85508 | FreeIPMI 1.6.18 ipmi-oem ipmi-oem/ipmi-oem-dell.c _output_dell_system_info_cmc_ipv6_info buffer overflow (Nessus ID 349117 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in FreeIPMI 1.6.18. It has been rated as very critical. This impacts the function _output_dell_system_info_cmc_ipv6_info of the file ipmi-oem/ipmi-oem-dell.c of the component ipmi-oem. This manipulation causes buffer overflow. This vulnerability is handled as CVE-2026-85508. The attack can be initiated remotely. There is... Weiterlesen

CVE-2026-85509 | FreeIPMI up to 1.6.18 Fru ipmi-fru.c _read_fru_data stack-based overflow (Nessus ID 342824 / WID-SEC-2026-4155)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability labeled as very critical has been found in FreeIPMI up to 1.6.18. Affected by this issue is the function _read_fru_data of the file libfreeipmi/fru/ipmi-fru.c of the component Fru. Executing a manipulation can lead to stack-based buffer overflow. The identification of this vulnerability is CVE-2026-85509. The attack may be launched... Weiterlesen

CVE-2022-48064 | GNU Binutils up to 2.39 ELF File dwarf2.c bfd_dwarf2_find_nearest_line_with_alt memory allocation (EUVD-2022-50778 / Nessus ID 234115)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability classified as problematic has been found in GNU Binutils up to 2.39. This affects the function bfd_dwarf2_find_nearest_line_with_alt of the file dwarf2.c of the component ELF File Handler. Performing a manipulation results in uncontrolled memory allocation. This vulnerability was named CVE-2022-48064. The attack needs to be... Weiterlesen

CVE-2022-48065 | GNU Binutils up to 2.39 dwarf2.c find_abstract_instance memory leak (EUVD-2022-50779 / Nessus ID 234114)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability classified as problematic was found in GNU Binutils up to 2.39. Affected by this issue is the function find_abstract_instance of the file dwarf2.c. The manipulation results in memory leak. This vulnerability was named CVE-2022-48065. The attack needs to be approached within the local network. There is no available exploit.... Weiterlesen

CVE-2022-48066 | TOTOLINK A830R 4.1.2cu.5182 Cookie global.so improper authentication (EUVD-2022-50780)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability, which was classified as critical, was found in TOTOLINK A830R 4.1.2cu.5182. This vulnerability affects unknown code in the library global.so of the component Cookie Handler. Such manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2022-48066. The attack can only be initiated within the... Weiterlesen

CVE-2022-48067 | TOTOLINK A830R 4.1.2cu.5182 information disclosure (EUVD-2022-50781)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in TOTOLINK A830R 4.1.2cu.5182. It has been rated as problematic. Impacted is an unknown function. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2022-48067. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-80927 | Linux Kernel up to 6.18.49/7.2.3 timekeeping __do_adjtimex stack-based overflow (WID-SEC-2026-3321)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability has been found in Linux Kernel up to 6.18.49/7.2.3 and classified as problematic. The impacted element is the function __do_adjtimex of the component timekeeping. The manipulation leads to stack-based buffer overflow. This vulnerability is traded as CVE-2026-80927. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2025-61457 | code16 Sharp 9.6.6 SharpFormUploadField.php cross site scripting (ID 611)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability was found in code16 Sharp 9.6.6. It has been classified as problematic. Affected is an unknown function of the file src/Form/Fields/SharpFormUploadField.php. Performing a manipulation results in cross site scripting. This vulnerability is cataloged as CVE-2025-61457. It is possible to initiate the attack remotely. There is no... Weiterlesen

CVE-2025-60790 | ProcessWire CMS up to 3.0.245 ZIP resource consumption (Issue 2120)

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability marked as problematic has been reported in ProcessWire CMS up to 3.0.245. This affects an unknown part of the component ZIP Handler. This manipulation causes resource consumption. This vulnerability is handled as CVE-2025-60790. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the... Weiterlesen

CVE-2025-60934 | HR Performance Solutions Performance Pro 3.19.17 index.php Employee Notes/title/description cross site scripting

Tue, 27 Oct 2026 13:55:48 +0100

A vulnerability classified as problematic was found in HR Performance Solutions Performance Pro 3.19.17. This impacts an unknown function of the file index.php. Executing a manipulation of the argument Employee Notes/title/description can lead to cross site scripting. This vulnerability is registered as CVE-2025-60934. It is possible to launch the... Weiterlesen

Plesk Security Updates for PHP CVE-2026-109618 and CVE-2026-109619

Tue, 27 Oct 2026 13:53:49 +0100

On 21 October 2026, the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. Both can allow remote code execution, and both are rated critical with a CVSS score of 9.2. Because Plesk ships PHP for hosted websites and uses its own PHP engine to run the Plesk […] The... Weiterlesen

CVEngine

Tue, 27 Oct 2026 13:44:48 +0100

AI-first external attack surface assessment with continuous discovery, evidence-based vulnerability validation, and developer-agent MCP integration. Weiterlesen

CVE-2022-3437 | Samba up to 4.15.10/4.16.5/4.17.1 Heimdal GSSAPI Library malloc buffer overflow (Nessus ID 211098 / WID-SEC-2026-3352)

Tue, 27 Oct 2026 12:20:13 +0100

A vulnerability was found in Samba up to 4.15.10/4.16.5/4.17.1. It has been classified as critical. Affected is the function malloc of the component Heimdal GSSAPI Library. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2022-3437. The attack is possible to be carried out remotely. No exploit exists. Upgrading the... Weiterlesen

CVE-2026-28933 | Apple macOS up to 14.8.7/15.7.7/26.5 use after free (WID-SEC-2026-3352)

Tue, 27 Oct 2026 12:20:13 +0100

A vulnerability, which was classified as problematic, was found in Apple macOS up to 14.8.7/15.7.7/26.5. The impacted element is an unknown function. Executing a manipulation can lead to use after free. This vulnerability is tracked as CVE-2026-28933. The attack can be launched remotely. No exploit exists. You should upgrade the affected component. Weiterlesen

CVE-2026-28934 | Apple macOS up to 15.7/26/26.6 buffer overflow (WID-SEC-2026-3352)

Tue, 27 Oct 2026 12:20:13 +0100

A vulnerability described as critical has been identified in Apple macOS up to 15.7/26/26.6. This vulnerability affects unknown code. The manipulation results in buffer overflow. This vulnerability was named CVE-2026-28934. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended. Weiterlesen

CVE-2025-10275 | YunaiV yudao-cloud up to 2025.09 /crm/business/transfer ids/newOwnerUserId improper authorization (EUVD-2025-28999)

Tue, 27 Oct 2026 10:03:17 +0100

A vulnerability was found in YunaiV yudao-cloud up to 2025.09. It has been declared as critical. This affects an unknown part of the file /crm/business/transfer. Executing a manipulation of the argument ids/newOwnerUserId can lead to improper authorization. The identification of this vulnerability is CVE-2025-10275. The attack may be launched... Weiterlesen

CVE-2025-10276 | YunaiV ruoyi-vue-pro up to 2025.09 /crm/contract/transfer id/newOwnerUserId improper authorization (EUVD-2025-29006)

Tue, 27 Oct 2026 10:03:17 +0100

A vulnerability was found in YunaiV ruoyi-vue-pro up to 2025.09. It has been rated as critical. This vulnerability affects unknown code of the file /crm/contract/transfer. The manipulation of the argument id/newOwnerUserId leads to improper authorization. This vulnerability is referenced as CVE-2025-10276. Remote exploitation of the attack is... Weiterlesen

CVE-2025-10278 | YunaiV ruoyi-vue-pro up to 2025.09 /crm/contact/transfer ids/newOwnerUserId improper authorization (EUVD-2025-29008)

Tue, 27 Oct 2026 10:03:17 +0100

A vulnerability identified as critical has been detected in YunaiV ruoyi-vue-pro up to 2025.09. Impacted is an unknown function of the file /crm/contact/transfer. This manipulation of the argument ids/newOwnerUserId causes improper authorization. This vulnerability is tracked as CVE-2025-10278. The attack is possible to be carried out remotely.... Weiterlesen

CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)

Tue, 27 Oct 2026 09:45:24 +0100

Posted by jose on Oct 27CVE-2026-109618: Pointer underflow in PHP's CGI SAPI enables unauthenticated remote code execution. Affected: ALL PHP versions 5.x through 8.4.26 with cgi.fix_pathinfo=1 (default configuration). Same vulnerability class as CVE-2019-11043 (PHP-FPM, CVSS 9.8, patched 2019) — the CGI SAPI never received the equivalent fix.... Weiterlesen

CVE-2026-33867 | WWBN AVideo up to 26.0 Database cleartext storage (GHSA-363v-5rh8-23wg)

Tue, 27 Oct 2026 08:13:20 +0100

A vulnerability, which was classified as problematic, has been found in WWBN AVideo up to 26.0. Affected by this vulnerability is an unknown functionality of the component Database Handler. Performing a manipulation results in cleartext storage of sensitive information. This vulnerability is identified as CVE-2026-33867. The attack can be... Weiterlesen

CVE-2026-34362 | WWBN AVideo up to 26.0 functions.php verifyTokenSocket session expiration (GHSA-2mg4-pfgx-64cf)

Tue, 27 Oct 2026 08:13:17 +0100

A vulnerability classified as critical has been found in WWBN AVideo up to 26.0. The affected element is the function verifyTokenSocket of the file plugin/YPTSocket/functions.php. The manipulation leads to session expiration. This vulnerability is referenced as CVE-2026-34362. Remote exploitation of the attack is possible. No exploit is available.... Weiterlesen

CVE-2026-33767 | WWBN AVideo up to 26.0 Query String objects/like.php getLike videos_id sql injection (GHSA-fj74-qxj7-r3vc)

Tue, 27 Oct 2026 08:13:16 +0100

A vulnerability labeled as critical has been found in WWBN AVideo up to 26.0. This vulnerability affects the function getLike of the file objects/like.php of the component Query String Handler. Such manipulation of the argument videos_id leads to sql injection. This vulnerability is uniquely identified as CVE-2026-33767. The attack can be launched... Weiterlesen

CVE-2026-33770 | WWBN AVideo up to 26.0 Title objects/category.php fixCleanTitle clean_title sql injection (GHSA-584p-rpvq-35vf)

Tue, 27 Oct 2026 08:13:14 +0100

A vulnerability marked as critical has been reported in WWBN AVideo up to 26.0. This issue affects the function fixCleanTitle of the file objects/category.php of the component Title Handler. Performing a manipulation of the argument clean_title results in sql injection. This vulnerability was named CVE-2026-33770. The attack may be initiated... Weiterlesen

CVE-2026-4960 | Tenda AC6 15.03.05.16 POST Request /goform/WizardHandle fromWizardHandle WANT/WANS stack-based overflow

Tue, 27 Oct 2026 08:13:12 +0100

A vulnerability classified as critical was found in Tenda AC6 15.03.05.16. Affected is the function fromWizardHandle of the file /goform/WizardHandle of the component POST Request Handler. Executing a manipulation of the argument WANT/WANS can lead to stack-based buffer overflow. This vulnerability is handled as CVE-2026-4960. The attack can be... Weiterlesen

CVE-2026-4959 | OpenBMB XAgent 1.0.0 ShareServer WebSocket Endpoint share.py check_user interaction_id missing authentication

Tue, 27 Oct 2026 08:13:10 +0100

A vulnerability classified as critical has been found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/application/websockets/share.py of the component ShareServer WebSocket Endpoint. Performing a manipulation of the argument interaction_id results in missing authentication. This vulnerability is known as... Weiterlesen

CVE-2026-116371 | Akuvox Akubela HyPanel PS51 51.130.40.26 /login engrmode improper authentication

Tue, 27 Oct 2026 07:10:12 +0100

A vulnerability was found in Akuvox Akubela HyPanel PS51 51.130.40.26. It has been declared as critical. The impacted element is an unknown function of the file /login. Executing a manipulation of the argument engrmode with the input admin can lead to improper authentication. The identification of this vulnerability is CVE-2026-116371. The attack... Weiterlesen

CVE-2026-38812 | RuoYi up to 4.8.3 /tool/gen/createTable sql injection

Tue, 27 Oct 2026 07:10:12 +0100

A vulnerability classified as critical was found in RuoYi up to 4.8.3. Affected by this vulnerability is an unknown functionality of the file /tool/gen/createTable. Executing a manipulation can lead to sql injection. This vulnerability is registered as CVE-2026-38812. It is possible to launch the attack remotely. Furthermore, an exploit is... Weiterlesen

CVE-2026-84942 – Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards

Tue, 27 Oct 2026 07:04:31 +0100

Read this article This article has been indexed from Latest Bulletins Read the original article: CVE-2026-84942 – Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards The post CVE-2026-84942 – Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards appeared first on IT Security... Weiterlesen

CVE-2026-33764 | WWBN AVideo up to 26.0 save.json.php id authorization

Tue, 27 Oct 2026 06:01:01 +0100

A vulnerability, which was classified as problematic, has been found in WWBN AVideo up to 26.0. The impacted element is an unknown function of the file save.json.php. The manipulation of the argument ID leads to authorization bypass. This vulnerability is documented as CVE-2026-33764. The attack can be initiated remotely. There is not any exploit... Weiterlesen

CVE-2026-4953 | mingSoft MCMS up to 5.5.0 Editor Endpoint BaseAction.java catchImage catchimage server-side request forgery

Tue, 27 Oct 2026 06:01:00 +0100

A vulnerability categorized as critical has been discovered in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/mingsoft/cms/action/BaseAction.java of the component Editor Endpoint. Executing a manipulation of the argument catchimage can lead to server-side request forgery. This vulnerability is registered as... Weiterlesen

CVE-2026-4954 | mingSoft MCMS up to 5.5.0 Web Content List Endpoint ContentAction.java list sql injection

Tue, 27 Oct 2026 06:01:00 +0100

A vulnerability identified as critical has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/mingsoft/cms/action/web/ContentAction.java of the component Web Content List Endpoint. The manipulation leads to sql injection. This vulnerability is documented as CVE-2026-4954. The attack can be initiated remotely.... Weiterlesen

CVE-2026-33766 | WWBN AVideo up to 26.0 HTTP Redirect isSSRFSafeURL server-side request forgery

Tue, 27 Oct 2026 06:00:58 +0100

A vulnerability was found in WWBN AVideo up to 26.0 and classified as critical. Affected is the function isSSRFSafeURL of the component HTTP Redirect Handler. Such manipulation leads to server-side request forgery. This vulnerability is traded as CVE-2026-33766. The attack may be launched remotely. There is no exploit available. It is advisable to... Weiterlesen

CVE-2026-33761 | WWBN AVideo up to 26.0 Email Message list.json.php User::isAdmin authorization

Tue, 27 Oct 2026 06:00:58 +0100

A vulnerability classified as problematic was found in WWBN AVideo up to 26.0. The affected element is the function User::isAdmin of the file list.json.php of the component Email Message Handler. Executing a manipulation can lead to missing authorization. This vulnerability is registered as CVE-2026-33761. It is possible to launch the attack... Weiterlesen

CVE-2026-33763 | WWBN AVideo up to 26.0 API Endpoint get_api_video_password_is_correct passwordIsCorrect excessive authentication

Tue, 27 Oct 2026 06:00:58 +0100

A vulnerability classified as problematic has been found in WWBN AVideo up to 26.0. Impacted is the function get_api_video_password_is_correct of the component API Endpoint. Performing a manipulation of the argument passwordIsCorrect results in improper restriction of excessive authentication attempts. This vulnerability is cataloged as... Weiterlesen

CVE-2026-5010 | Sanoma Clickedu up to 5.0 URL /user.php cross site scripting

Tue, 27 Oct 2026 06:00:57 +0100

A vulnerability described as problematic has been identified in Sanoma Clickedu up to 5.0. This issue affects some unknown processing of the file /user.php of the component URL Handler. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2026-5010. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-4958 | OpenBMB XAgent 1.0.0 WebSocket Endpoint replayer.py ReplayServer.on_connect/ReplayServer.send_data interaction_id authorization

Tue, 27 Oct 2026 06:00:57 +0100

A vulnerability described as problematic has been identified in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/application/websockets/replayer.py of the component WebSocket Endpoint. Such manipulation of the argument interaction_id leads to authorization bypass. This... Weiterlesen

CVE-2026-4957 | OpenBMB XAgent 1.0.0 API Key function_handler.py FunctionHandler.handle_tool_call api_key log file

Tue, 27 Oct 2026 06:00:56 +0100

A vulnerability marked as problematic has been reported in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of the component API Key Handler. This manipulation of the argument api_key causes sensitive information in log files. This vulnerability appears as... Weiterlesen

CVE-2026-4956 | Shenzhen Ruiming Technology Streamax Crocus 1.3.44 Parameter DevicePrint.do?Action=ReadTask State sql injection

Tue, 27 Oct 2026 06:00:56 +0100

A vulnerability labeled as critical has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Action=ReadTask of the component Parameter Handler. The manipulation of the argument State results in sql injection. This vulnerability is reported as CVE-2026-4956. The... Weiterlesen

CVE-2026-88781 | ASUS Firmware I/O Command null pointer dereference (EUVD-2026-110597)

Tue, 27 Oct 2026 06:00:55 +0100

A vulnerability labeled as very critical has been found in ASUS Firmware. The impacted element is an unknown function of the component IO Command. The manipulation results in null pointer dereference. This vulnerability was named CVE-2026-88781. The attack needs to be approached locally. There is no available exploit. Weiterlesen

CVE-2026-111147 | libyal libesedb up to 20260704 libesedb_record_get_multi_value out-of-bounds (EUVD-2026-102274)

Tue, 27 Oct 2026 06:00:54 +0100

A vulnerability identified as problematic has been detected in libyal libesedb up to 20260704. This affects the function libesedb_record_get_multi_value. This manipulation causes out-of-bounds read. This vulnerability is registered as CVE-2026-111147. The attack needs to be launched locally. No exploit is available. Weiterlesen

CVE-2026-111135 | libyal libfwsi up to 20260522 MTP Volume libfwsi_mtp_volume_values_read_data out-of-bounds (EUVD-2026-102262)

Tue, 27 Oct 2026 06:00:54 +0100

A vulnerability was found in libyal libfwsi up to 20260522. It has been classified as problematic. Affected by this issue is the function libfwsi_mtp_volume_values_read_data of the component MTP Volume Handler. This manipulation causes out-of-bounds read. This vulnerability is tracked as CVE-2026-111135. The attack is restricted to local... Weiterlesen

CVE-2026-111134 | libyal libfwsi up to 20260522 MTP File libfwsi_mtp_file_entry_values_read_data out-of-bounds (EUVD-2026-102261)

Tue, 27 Oct 2026 06:00:54 +0100

A vulnerability was found in libyal libfwsi up to 20260522 and classified as problematic. Affected by this vulnerability is the function libfwsi_mtp_file_entry_values_read_data of the component MTP File Handler. The manipulation results in out-of-bounds read. This vulnerability is identified as CVE-2026-111134. The attack is only possible with... Weiterlesen

CVE-2026-110613 | youlaitech youlai-mall App Order List Endpoint improper authorization (EUVD-2026-101241)

Tue, 27 Oct 2026 06:00:54 +0100

A vulnerability marked as problematic has been reported in youlaitech youlai-mall. The impacted element is an unknown function of the component App Order List Endpoint. The manipulation leads to improper authorization. This vulnerability is listed as CVE-2026-110613. The attack may be initiated remotely. There is no available exploit. Applying a... Weiterlesen

CVE-2026-110598 | libyal libpff up to 20260926 libpff_record_entry_get_multi_value integer underflow (EUVD-2026-101226)

Tue, 27 Oct 2026 06:00:54 +0100

A vulnerability categorized as problematic has been discovered in libyal libpff up to 20260926. Affected by this issue is the function libpff_record_entry_get_multi_value. The manipulation results in integer underflow. This vulnerability is identified as CVE-2026-110598. The attack is only possible with local access. There is not any exploit... Weiterlesen

CVE-2026-109564 | LearnHouse up to 1.3.x duplicate improper authorization (EUVD-2026-97887)

Tue, 27 Oct 2026 06:00:52 +0100

A vulnerability has been found in LearnHouse up to 1.3.x and classified as critical. This issue affects some unknown processing of the file /api/v1/playgrounds/{uuid}/duplicate. The manipulation leads to improper authorization. This vulnerability is referenced as CVE-2026-109564. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

CVE-2026-109425 | tink-crypto tink-go up to 2.8.0 Keyset keyset.NewHandleWithNoSecrets/ReadWithNoSecrets input validation (EUVD-2026-97823)

Tue, 27 Oct 2026 06:00:52 +0100

A vulnerability, which was classified as problematic, was found in tink-crypto tink-go up to 2.8.0. This affects the function keyset.NewHandleWithNoSecrets/ReadWithNoSecrets of the component Keyset. The manipulation results in improper input validation. This vulnerability is identified as CVE-2026-109425. The attack can be executed remotely. There... Weiterlesen

CVE-2026-109438 | 3proxy up to 1.0.1 SOCKS4 Reply Path uninitialized resource (EUVD-2026-101290)

Tue, 27 Oct 2026 06:00:50 +0100

A vulnerability was found in 3proxy up to 1.0.1. It has been classified as problematic. This issue affects some unknown processing of the component SOCKS4 Reply Path. This manipulation causes uninitialized resource. This vulnerability is handled as CVE-2026-109438. The attack can be initiated remotely. There is not any exploit available. Applying... Weiterlesen

CVE-2026-82333 | multer up to 2.2.x Field Parser denial of service (Nessus ID 372179)

Tue, 27 Oct 2026 06:00:49 +0100

A vulnerability identified as problematic has been detected in multer up to 2.2.x. This affects an unknown function of the component Field Parser. The manipulation leads to denial of service. This vulnerability is referenced as CVE-2026-82333. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected... Weiterlesen

CVE-2026-99091 | Linux Kernel up to 6.6.159/6.12.112/6.18.56/7.2.10 Bluetooth MGMT cmd_complete_rsp memory corruption (Nessus ID 372178)

Tue, 27 Oct 2026 06:00:49 +0100

A vulnerability was found in Linux Kernel up to 6.6.159/6.12.112/6.18.56/7.2.10. It has been rated as critical. Impacted is the function cmd_complete_rsp of the component Bluetooth MGMT. This manipulation causes memory corruption. This vulnerability is registered as CVE-2026-99091. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

CVE-2026-107080 | uclouvain OpenJPEG 2.4.0/2.5.4 DWT src/lib/openjp2/dwt.c opj_dwt_encode_and_deinterleave_v out-of-bounds (8314119b / Nessus ID 372177)

Tue, 27 Oct 2026 06:00:48 +0100

A vulnerability has been found in uclouvain OpenJPEG 2.4.0/2.5.4 and classified as critical. Affected is the function opj_dwt_encode_and_deinterleave_v of the file src/lib/openjp2/dwt.c of the component DWT. Performing a manipulation results in out-of-bounds read. This vulnerability was named CVE-2026-107080. The attack may be initiated remotely.... Weiterlesen

CVE-2026-99073 | Linux Kernel up to 6.12.112/6.18.56/7.2.10 ipv4 fib fib_dump_info_fnhe null pointer dereference (Nessus ID 372176)

Tue, 27 Oct 2026 06:00:48 +0100

A vulnerability was found in Linux Kernel up to 6.12.112/6.18.56/7.2.10. It has been declared as critical. The impacted element is the function fib_dump_info_fnhe of the component ipv4 fib. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2026-99073. The attack can be launched remotely. No exploit... Weiterlesen

CVE-2026-109391 | Square Squash YAML YAML.load deserialization (EUVD-2026-97489)

Tue, 27 Oct 2026 06:00:48 +0100

A vulnerability was found in Square Squash. It has been declared as critical. This affects the function YAML.load of the component YAML Handler. Executing a manipulation can lead to deserialization. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability appears as CVE-2026-109391. The attack may... Weiterlesen

CVE-2026-105223 | maclof kubernetes-client up to 0.31.x parseKubeconfig/parseKubeconfigFile certificate validation (EUVD-2026-92155)

Tue, 27 Oct 2026 06:00:48 +0100

A vulnerability, which was classified as problematic, has been found in maclof kubernetes-client up to 0.31.x. This impacts the function parseKubeconfig/parseKubeconfigFile. The manipulation leads to improper certificate validation. This vulnerability is uniquely identified as CVE-2026-105223. The attack is possible to be carried out remotely. No... Weiterlesen

CVE-2026-104084 | SmarterTools SmarterMail up to 9560 refresh-token privileges management (EUVD-2026-95890 / WID-SEC-2026-3869)

Tue, 27 Oct 2026 06:00:42 +0100

A vulnerability classified as critical has been found in SmarterTools SmarterMail. The impacted element is an unknown function of the file /api/v1/auth/refresh-token. This manipulation causes improper privilege management. The identification of this vulnerability is CVE-2026-104084. It is possible to initiate the attack remotely. There is no... Weiterlesen

CVE-2026-105216 | micro go-micro up to 5.x information disclosure (EUVD-2026-92119)

Tue, 27 Oct 2026 06:00:40 +0100

A vulnerability marked as problematic has been reported in micro go-micro up to 5.x. This affects an unknown part. The manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-105216. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component. Weiterlesen

CVE-2026-104083 | SmarterTools SmarterMail up to 9560 HTML Sanitizer message-iframe HTML injection (EUVD-2026-95888 / WID-SEC-2026-3869)

Tue, 27 Oct 2026 06:00:38 +0100

A vulnerability was found in SmarterTools SmarterMail. It has been classified as problematic. This affects an unknown part of the file /interface/message-iframe of the component HTML Sanitizer. This manipulation causes HTML injection. This vulnerability is registered as CVE-2026-104083. Remote exploitation of the attack is possible. No exploit is... Weiterlesen

CVE-2026-104079 | Syed Balkhi Envira Gallery Lite Plugin up to 1.16.1 Gallery Conversion Endpoint privileges management (EUVD-2026-95769)

Tue, 27 Oct 2026 06:00:36 +0100

A vulnerability classified as problematic was found in Syed Balkhi Envira Gallery Lite Plugin up to 1.16.1. Affected by this issue is some unknown functionality of the component Gallery Conversion Endpoint. Such manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-104079. The attack can be executed... Weiterlesen

Heap overflow in EDK2’s Brotli decompressor: the CVE-2021-28211 fix was applied to LZMA and never to Brotli

Tue, 27 Oct 2026 05:55:22 +0100

submitted by /u/lcpjj_ [link] [comments] Weiterlesen

CVE-2026-65801 | Microsoft Exchange Online server-side request forgery (EUVD-2026-63689)

Tue, 27 Oct 2026 03:42:35 +0100

A vulnerability was found in Microsoft Exchange Online and classified as critical. Impacted is an unknown function. Such manipulation leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2026-65801. The attack can be launched remotely. No exploit exists. This product is a managed service, which means users... Weiterlesen

CVE-2026-72970 | Microsoft Edge up to 151.0.4129.78 buffer overflow (EUVD-2026-58754)

Tue, 27 Oct 2026 03:42:35 +0100

A vulnerability classified as critical has been found in Microsoft Edge. The impacted element is an unknown function. This manipulation causes buffer overflow. This vulnerability is tracked as CVE-2026-72970. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component. Weiterlesen

CVE-2026-50515 | Microsoft Azure Service Bus deserialization (EUVD-2026-54324)

Tue, 27 Oct 2026 03:42:34 +0100

A vulnerability classified as critical has been found in Microsoft Azure Service Bus. This affects an unknown part. The manipulation leads to deserialization. This vulnerability is documented as CVE-2026-50515. The attack can be initiated remotely. There is not any exploit available. This product is provided as a managed service, meaning users do... Weiterlesen

CVE-2026-63520 | Microsoft SharePoint Server input validation (EUVD-2026-56298)

Tue, 27 Oct 2026 03:42:33 +0100

A vulnerability was found in Microsoft SharePoint Server. It has been declared as critical. This vulnerability affects unknown code. Executing a manipulation can lead to improper input validation. The identification of this vulnerability is CVE-2026-63520. The attack may be launched remotely. There is no exploit available. It is best practice to... Weiterlesen

CVE-2026-63516 | Microsoft SharePoint Server deserialization (EUVD-2026-56297)

Tue, 27 Oct 2026 03:42:32 +0100

A vulnerability was found in Microsoft SharePoint Server. It has been classified as critical. This affects an unknown part. Performing a manipulation results in deserialization. This vulnerability was named CVE-2026-63516. The attack may be initiated remotely. There is no available exploit. Applying a patch is the recommended action to fix this... Weiterlesen

CVE-2026-63512 | Microsoft SharePoint Server improper authorization (EUVD-2026-56296)

Tue, 27 Oct 2026 03:42:32 +0100

A vulnerability labeled as problematic has been found in Microsoft SharePoint Server. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2026-63512. It is possible to launch the attack remotely. No exploit is available. It is best practice to... Weiterlesen

CVE-2025-63499 | Alinto Sogo 5.12.3 theme cross site scripting (EUVD-2025-201283 / Nessus ID 277525)

Tue, 27 Oct 2026 03:42:32 +0100

A vulnerability classified as problematic has been found in Alinto Sogo 5.12.3. This impacts an unknown function. Performing a manipulation of the argument theme results in cross site scripting. This vulnerability is identified as CVE-2025-63499. The attack can be initiated remotely. There is not any exploit available. Weiterlesen

CVE-2025-46175 | y_project RuoYi 4.8.0 SysUserController.java authRole access control (EUVD-2025-199727)

Tue, 27 Oct 2026 03:42:30 +0100

A vulnerability categorized as critical has been discovered in y_project RuoYi 4.8.0. The affected element is the function authRole of the file SysUserController.java. Such manipulation leads to improper access controls. This vulnerability is traded as CVE-2025-46175. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2025-65877 | Lvzhou CMS title sql injection (EUVD-2025-200301)

Tue, 27 Oct 2026 03:42:30 +0100

A vulnerability labeled as critical has been found in Lvzhou CMS. This impacts an unknown function of the component com.wanli.lvzhoucms.service.ContentService#findPage. The manipulation of the argument Title results in sql injection. This vulnerability is cataloged as CVE-2025-65877. The attack may be launched remotely. There is no exploit... Weiterlesen

CVE-2025-65656 | Dcat-Admin up to 2.2.3-beta VersionManager.php file inclusion

Tue, 27 Oct 2026 03:42:30 +0100

A vulnerability identified as problematic has been detected in Dcat-Admin up to 2.2.3-beta. Affected is an unknown function of the file admin/src/Extend/VersionManager.php. The manipulation leads to file inclusion. This vulnerability is documented as CVE-2025-65656. The attack requires being on the local network. There is not any exploit available. Weiterlesen

CVE-2025-65358 | edoc-doctor-appointment-system 1.0.1 /admin/appointment.php docid sql injection

Tue, 27 Oct 2026 03:42:30 +0100

A vulnerability categorized as critical has been discovered in edoc-doctor-appointment-system 1.0.1. This impacts an unknown function of the file /admin/appointment.php. Executing a manipulation of the argument docid can lead to sql injection. This vulnerability is registered as CVE-2025-65358. It is possible to launch the attack remotely. No... Weiterlesen

CVE-2025-63365 | SoftSea EPUB File Reader 1.0.0.0 EPUB File Parser path traversal

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability labeled as critical has been found in SoftSea EPUB File Reader 1.0.0.0. Impacted is an unknown function of the component EPUB File Parser. Executing a manipulation can lead to path traversal. This vulnerability is registered as CVE-2025-63365. It is possible to launch the attack remotely. No exploit is available. Weiterlesen

CVE-2025-63528 | Blood Bank Management System 1.0 blooddinfo.php error cross site scripting

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability has been found in Blood Bank Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file blooddinfo.php. Performing a manipulation of the argument Error results in cross site scripting. This vulnerability is identified as CVE-2025-63528. The attack can be initiated... Weiterlesen

CVE-2025-51735 | HCL Unica 12.0.0 csv injection

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability categorized as problematic has been discovered in HCL Unica 12.0.0. This vulnerability affects unknown code. Executing a manipulation can lead to csv injection. The identification of this vulnerability is CVE-2025-51735. The attack may be launched remotely. There is no exploit available. Weiterlesen

CVE-2026-0640 | Tenda AC23 16.03.07.52 /goform/PowerSaveSet sscanf time buffer overflow

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability classified as critical was found in Tenda AC23 16.03.07.52. This affects the function sscanf of the file /goform/PowerSaveSet. Executing a manipulation of the argument Time can lead to buffer overflow. This vulnerability is tracked as CVE-2026-0640. The attack can be launched remotely. Moreover, an exploit is present. Weiterlesen

CVE-2026-0618 | Devolutions PowerShell Universal up to 4.5.5/5.6.12 cross site scripting (DEVO-2026-0001)

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability described as problematic has been identified in Devolutions PowerShell Universal up to 4.5.5/5.6.12. Impacted is an unknown function. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-0618. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component... Weiterlesen

CVE-2026-20026 | Cisco Secure Firewall Threat Defense Software Snort 3 Detection Engine double free (cisco-sa-snort3-dcerpc-vulns-J9HNF4tH / WID-SEC-2026-0041)

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability, which was classified as problematic, has been found in Cisco Secure Firewall Threat Defense Software and UTD SNORT IPS Engine Software. The impacted element is an unknown function of the component Snort 3 Detection Engine. This manipulation causes double free. This vulnerability is tracked as CVE-2026-20026. The attack is possible... Weiterlesen

CVE-2026-0650 | OpenFlagr up to 1.1.18 HTTP Middleware missing authentication

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability described as critical has been identified in OpenFlagr Flagr up to 1.1.18. Affected is an unknown function of the component HTTP Middleware. Executing a manipulation can lead to missing authentication. This vulnerability appears as CVE-2026-0650. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-0628 | Google Chrome up to 143.0.7499.146 WebView Tag authorization (Nessus ID 281895 / WID-SEC-2026-0020)

Tue, 27 Oct 2026 03:42:29 +0100

A vulnerability was found in Google Chrome and classified as critical. Affected is an unknown function of the component WebView Tag Handler. The manipulation results in missing authorization. This vulnerability is identified as CVE-2026-0628. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the... Weiterlesen

CVE-2026-0642 | projectworlds House Rental and Property Listing 1.0 /app/complaint.php name cross site scripting (EUVD-2026-1142)

Tue, 27 Oct 2026 03:41:52 +0100

A vulnerability, which was classified as problematic, was found in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /app/complaint.php. The manipulation of the argument Name results in cross site scripting. This vulnerability is cataloged as CVE-2026-0642. The attack may be launched... Weiterlesen

CVE-2026-0641 | TOTOLINK WA300 5.2cu.7112_B20190227 cstecgi.cgi sub_401510 UPLOAD_FILENAME command injection (EUVD-2026-0958)

Tue, 27 Oct 2026 03:41:48 +0100

A vulnerability, which was classified as critical, has been found in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of the argument UPLOAD_FILENAME leads to command injection. This vulnerability is listed as CVE-2026-0641. The attack may be initiated remotely. In... Weiterlesen

CVE-2026-0578 | code-projects Online Product Reservation System 1.0 delete.php id sql injection (EUVD-2026-0779 / CNNVD-202601-795)

Tue, 27 Oct 2026 03:41:47 +0100

A vulnerability has been found in code-projects Online Product Reservation System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /handgunner-administrator/delete.php. The manipulation of the argument ID leads to sql injection. This vulnerability is documented as CVE-2026-0578. The attack can be... Weiterlesen

CVE-2026-0747 | Devolutions Remote Desktop Manager up to 2025.3.28.0 on Windows information disclosure (DEVO-2026-0002 / Nessus ID 286266)

Tue, 27 Oct 2026 03:41:46 +0100

A vulnerability was found in Devolutions Remote Desktop Manager up to 2025.3.28.0 on Windows and classified as problematic. The impacted element is an unknown function. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-0747. The physical device can be targeted for the attack. There is... Weiterlesen

CVE-2026-0719 | libsoup NTLM md4sum stack-based overflow (ID 477 / EUVD-2026-1573)

Tue, 27 Oct 2026 03:41:45 +0100

A vulnerability classified as critical was found in libsoup. The impacted element is the function md4sum of the component NTLM. The manipulation results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-0719. The attack is only possible with local access. There is not any exploit available. Weiterlesen

CVE-2026-0707 | Keycloak on Red Hat Authorization Header authorization before parsing and canonicalization (Nessus ID 300554 / WID-SEC-2026-0034)

Tue, 27 Oct 2026 03:41:44 +0100

A vulnerability, which was classified as problematic, has been found in Keycloak on Red Hat. This impacts an unknown function of the component Authorization Header Handler. The manipulation leads to authorization before parsing and canonicalization. This vulnerability is traded as CVE-2026-0707. It is possible to initiate the attack remotely.... Weiterlesen

CVE-2026-0700 | code-projects Intern Membership Management System 1.0 check_admin.php username sql injection

Tue, 27 Oct 2026 03:41:44 +0100

A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. This vulnerability is handled as CVE-2026-0700. The attack can be executed remotely.... Weiterlesen

CVE-2026-0701 | code-projects Intern Membership Management System 1.0 add_admin.php username sql injection

Tue, 27 Oct 2026 03:41:44 +0100

A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/add_admin.php. The manipulation of the argument Username leads to sql injection. This vulnerability is uniquely identified as CVE-2026-0701.... Weiterlesen

CVE-2026-33366 | Buffalo Wi-Fi Router missing authentication

Tue, 27 Oct 2026 03:41:42 +0100

A vulnerability, which was classified as critical, has been found in Buffalo Wi-Fi Router. This affects an unknown function. Performing a manipulation results in missing authentication. This vulnerability was named CVE-2026-33366. The attack may be initiated remotely. There is no available exploit. Weiterlesen

CVE-2026-32678 | Buffalo Wi-Fi Router Setting authentication bypass

Tue, 27 Oct 2026 03:41:42 +0100

A vulnerability classified as critical was found in Buffalo Wi-Fi Router. The impacted element is an unknown function of the component Setting Handler. Such manipulation leads to authentication bypass using alternate channel. This vulnerability is uniquely identified as CVE-2026-32678. The attack can be launched remotely. No exploit exists. Weiterlesen

CVE-2026-32669 | Buffalo Wi-Fi Router code injection

Tue, 27 Oct 2026 03:41:41 +0100

A vulnerability described as critical has been identified in Buffalo Wi-Fi Router. Impacted is an unknown function. The manipulation results in code injection. This vulnerability is known as CVE-2026-32669. It is possible to launch the attack remotely. No exploit is available. Weiterlesen

CVE-2026-27650 | Buffalo Wi-Fi Router os command injection

Tue, 27 Oct 2026 03:41:17 +0100

A vulnerability marked as critical has been reported in Buffalo Wi-Fi Router. This issue affects some unknown processing. The manipulation leads to os command injection. This vulnerability is traded as CVE-2026-27650. It is possible to initiate the attack remotely. There is no exploit available. Weiterlesen

CVE-2026-33280 | Buffalo Wi-Fi Router backdoor

Tue, 27 Oct 2026 03:41:17 +0100

A vulnerability categorized as critical has been discovered in Buffalo Wi-Fi Router. Affected by this issue is some unknown functionality. Such manipulation leads to backdoor. This vulnerability is documented as CVE-2026-33280. The attack can be executed remotely. There is not any exploit available. Weiterlesen

CVE-2026-22744 | VMware Spring AI up to 1.0.4/1.1.3 RedisFilterExpressionConverter stringValue information disclosure

Tue, 27 Oct 2026 03:41:15 +0100

A vulnerability was found in VMware Spring AI up to 1.0.4/1.1.3. It has been rated as problematic. Affected by this vulnerability is the function stringValue of the component RedisFilterExpressionConverter. This manipulation causes information disclosure. This vulnerability is registered as CVE-2026-22744. Remote exploitation of the attack is... Weiterlesen

CVE-2026-4309 | NEC Platforms Aterm W1200EX Setting authorization

Tue, 27 Oct 2026 03:41:15 +0100

A vulnerability, which was classified as critical, has been found in NEC Platforms Aterm W1200EX, Aterm WG1200HP2, Aterm WG1900HP, Aterm WG1200HS2, Aterm WG1800HP3, Aterm WG1200HP3, Aterm WG1900HP2, Aterm WG1200HS3, Aterm WG1800HP4, Aterm WG1200HP4, Aterm WG1200HS4, Aterm WX1500HP, Aterm WG2600HS, Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HP4,... Weiterlesen

CVE-2026-3457 | Thales Sentinel LDK Runtime up to 10.21 on Windows cross site scripting (KB0027106)

Tue, 27 Oct 2026 03:41:14 +0100

A vulnerability classified as problematic was found in Thales Sentinel LDK Runtime up to 10.21 on Windows. Impacted is an unknown function. Such manipulation leads to cross site scripting. This vulnerability is traded as CVE-2026-3457. An attack has to be approached locally. There is no exploit available. Upgrading the affected component is... Weiterlesen

CVE-2026-116827 | YesWiki up to 4.6.x Bazar copyUrlToLocalFile server-side request forgery (EUVD-2026-110534)

Tue, 27 Oct 2026 03:41:14 +0100

A vulnerability was found in YesWiki up to 4.6.x. It has been declared as problematic. Affected by this vulnerability is the function copyUrlToLocalFile of the component Bazar. The manipulation results in server-side request forgery. This vulnerability is known as CVE-2026-116827. It is possible to launch the attack remotely. No exploit is... Weiterlesen

CVE-2026-116828 | YesWiki up to 4.6.x despam.php from sql injection (EUVD-2026-110535)

Tue, 27 Oct 2026 03:41:12 +0100

A vulnerability described as problematic has been identified in YesWiki up to 4.6.x. Affected by this vulnerability is an unknown functionality of the file despam.php. Such manipulation of the argument from leads to sql injection. This vulnerability is listed as CVE-2026-116828. The attack may be performed from remote. There is no available... Weiterlesen

CVE-2026-116826 | YesWiki up to 4.6.x DuplicationManager /api/pages downloadFile files server-side request forgery (EUVD-2026-110533)

Tue, 27 Oct 2026 03:41:07 +0100

A vulnerability was found in YesWiki up to 4.6.x. It has been rated as problematic. Affected by this issue is the function DuplicationManager::downloadFile of the file /api/pages of the component DuplicationManager. This manipulation of the argument files causes server-side request forgery. This vulnerability is handled as CVE-2026-116826. The... Weiterlesen

CVE-2026-116825 | YesWiki up to 4.6.2 HttpSignatureService verifySignature authentication replay (EUVD-2026-110532)

Tue, 27 Oct 2026 03:41:03 +0100

A vulnerability, which was classified as critical, has been found in YesWiki up to 4.6.2. The affected element is the function HttpSignatureService::verifySignature of the component HttpSignatureService. This manipulation causes authentication bypass by capture-replay. This vulnerability is registered as CVE-2026-116825. Remote exploitation of the... Weiterlesen

CVE-2026-116823 | YesWiki up to 4.6.x Bazar BazarField::getValue REQUEST cross site scripting (EUVD-2026-110530)

Tue, 27 Oct 2026 03:40:59 +0100

A vulnerability was found in YesWiki up to 4.6.x. It has been classified as problematic. Affected is the function BazarField::getValue of the component Bazar. The manipulation of the argument Request leads to cross site scripting. This vulnerability is traded as CVE-2026-116823. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

CVE-2026-116824 | YesWiki up to 4.6.x Referer referrers_sites.php cross site scripting (EUVD-2026-110531)

Tue, 27 Oct 2026 03:40:56 +0100

A vulnerability labeled as problematic has been found in YesWiki up to 4.6.x. This impacts an unknown function of the file handlers/page/referrers_sites.php of the component Referer Handler. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-116824. The attack can be executed remotely. There is not any... Weiterlesen

CVE-2026-116822 | YesWiki up to 4.6.x BazarListeAction template path traversal (EUVD-2026-110529)

Tue, 27 Oct 2026 03:40:55 +0100

A vulnerability was found in YesWiki up to 4.6.x. It has been declared as problematic. This affects the function BazarListeAction. Executing a manipulation of the argument template can lead to path traversal. This vulnerability is handled as CVE-2026-116822. The attack can be executed remotely. There is not any exploit available. It is recommended... Weiterlesen

CVE-2026-1496 | Black Duck Coverity up to 2025.12.0 API Endpoint /token authorization

Tue, 27 Oct 2026 03:40:49 +0100

A vulnerability was found in Black Duck Coverity up to 2024.12.1/2025.3.1/2025.6.3/2025.9.2/2025.12.0. It has been declared as critical. This impacts an unknown function of the file /token of the component API Endpoint. Such manipulation leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-1496. The attack can be... Weiterlesen

CVE-2026-33755 | Intermesh GroupOffice up to 6.8.157/25.0.91/26.0.16 Contact/query sql injection

Tue, 27 Oct 2026 03:40:44 +0100

A vulnerability categorized as critical has been discovered in Intermesh GroupOffice up to 6.8.157/25.0.91/26.0.16. This vulnerability affects unknown code of the file Contact/query. The manipulation results in sql injection. This vulnerability was named CVE-2026-33755. The attack may be performed from remote. There is no available exploit. It is... Weiterlesen

CVE-2026-33284 | globaleaks globaleaks-whistleblowing-software up to 5.0.88 /api/support input validation

Tue, 27 Oct 2026 03:40:42 +0100

A vulnerability was found in globaleaks globaleaks-whistleblowing-software up to 5.0.88. It has been classified as problematic. Affected by this vulnerability is an unknown functionality of the file /api/support. Performing a manipulation results in improper input validation. This vulnerability is known as CVE-2026-33284. Remote exploitation of... Weiterlesen

CVE-2026-33759 | WWBN AVideo up to 26.0 playlistsVideos.json.php playlists_id authorization

Tue, 27 Oct 2026 03:40:41 +0100

A vulnerability marked as problematic has been reported in WWBN AVideo up to 26.0. This vulnerability affects unknown code of the file objects/playlistsVideos.json.php. This manipulation of the argument playlists_id causes missing authorization. This vulnerability is tracked as CVE-2026-33759. The attack is possible to be carried out remotely. No... Weiterlesen

About Oracle MySQL and CVE-2016-6662

Tue, 27 Oct 2026 03:27:18 +0100

The issue On 12 September 2016 (three days ago) a MySQL security vulnerability was announced. The CVE id is CVE-2016-6662. There are 3 claims: By setting malloc-lib in the configuration file access to an OS root shell can be gained. By using the general log a configuration file can be written in any place which is writable for the OS mysql user.... Weiterlesen

Security advisory: CVE-2026-9740 and CVE-2026-11933 in Percona Server for MongoDB

Tue, 27 Oct 2026 02:40:13 +0100

TL;DR: This advisory covers the two most important high-severity memory-safety vulnerabilities affecting MongoDB Community and our downstream Percona Server for MongoDB – CVE-2026-11933 and CVE-2026-9740. Both will be addressed in a single coordinated patch release, bundled with other recently revealed lower-scored CVE fixes: CVE-2026-9753,... Weiterlesen

Still on MySQL 5.7 or 8.0? Those high-severity CVE fixes are covered

Tue, 27 Oct 2026 02:37:52 +0100

Upstream MySQL published an out-of-schedule release this week with two high-severity CVE fixes. If you’re running Percona Server for MySQL 5.7 or 8.0 under Extended Lifecycle Support (ELS), the program we previously called Post EOL Support, you don’t have to do anything to qualify for them. We’ve already applied the fixes and re-released the... Weiterlesen

CVE-2026-83400 | Oracle Java SE/GraalVM for JDK/GraalVM Enterprise Edition JAXP denial of service (Nessus ID 372040)